StackShip runs and manages your OpenTofu infrastructure. Connect a GitHub
repository, review every plan with policy checks and human approval, and keep a
versioned history of your state. StackShip speaks the same cloud protocol as
Terraform Cloud and HCP Terraform, so existing cloud blocks need only a new
hostname.
What you can do
- Run OpenTofu from GitHub. Pushes to a tracked branch plan and apply; pull requests get a plan-only preview reported as a GitHub check.
- Use the
tofuCLI you already know. Point acloudblock atstackship.runand runtofu plan,tofu apply, andtofu statecommands as usual. - Gate applies. Evaluate Rego policy against every plan and require an approval before anything changes.
- Keep state safe and portable. Every write creates a new state version you can inspect, download, or move out at any time.
- Connect clouds without long-lived keys. Use short-lived federation for AWS, Google Cloud, and Microsoft Azure.
- Share private modules through the built-in module registry.
- Automate with the REST API or an AI agent over MCP.
StackShip runs OpenTofu 1.6.0 and newer. It doesn’t run Terraform binaries.
How it’s organized
| Object | What it is |
|---|---|
| Organization | Your team’s account. Members, single sign-on, and the audit log live here. |
| Project | A folder that groups related workspaces. |
| Workspace | One OpenTofu configuration with its own state, variables, and run history. |
| Run | One plan, its policy checks, an optional approval, and an optional apply. |
See core concepts.
Choose a path
Quickstart
Connect GitHub, create a workspace, and review your first run. Start the quickstart.
Migrate
Move existing state from local files or Terraform Cloud. Read the migration guide.
Core concepts
Understand organizations, workspaces, runs, and state. Read core concepts.
Use the tofu CLI
Configure hostname = "stackship.run" and use normal tofu commands.
Set up CLI access.